When a user has the cash_management > anonymous_refund permission but NOT the cashup permission, they can access the cash register transaction history page (/cgi-bin/koha/pos/register.pl), but the cashups table fails to load with a 403 error. Steps to Reproduce: 1. Create a staff user with only cash_management > anonymous_refund permission (not cashup) 2. Navigate to Point of Sale > Transaction history for any cash register 3. Observe that the page loads but the cashups table shows a 403 error Expected Behavior: The cashups table should load successfully since the user has permission to view the page. Actual Behavior: The API endpoint /api/v1/cash_registers/{id}/cashups returns 403 Forbidden because it only checks for cashup permission.
Created attachment 192320 [details] [review] Bug 41751: Allow anonymous_refund permission to access cashups API The cash register transaction history page (pos/register.pl) allows access with either cashup OR anonymous_refund permission, but the API endpoints for fetching cashups only checked for cashup permission. This caused a 403 error when users with only anonymous_refund permission tried to view the transaction history page, as the cashups table failed to load. This patch updates the API permissions for: - GET /cash_registers/{id}/cashups - GET /cashups/{id} to accept either cashup or anonymous_refund permission, matching the page access logic. Test plan: 1. Create a staff user with only cash_management > anonymous_refund permission (not cashup) 2. Navigate to Point of Sale > Transaction history for any cash register 3. Verify the cashups table loads successfully (previously returned 403) 4. Run: prove t/db_dependent/api/v1/cashups.t